Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm a Linux newbie. I have a PHP script which, based on the correctness of a few parameters, decides whether to serve a file to the user or not. I'm serving files through the XSendFile feature in nginx. I'd like to block direct access to files so that the user is forced to download them through the PHP script.

My problem is that if I set the files permissions to 640, when I try to download directly I get a 403 Forbidden, but I'm unable to download it with the script as well. Whereas if I set it to 644, I'm able to do both things (I thought one needed to add the Execute permission to enable direct download of a file. Was I wrong?) How should I setup permissions to achieve what I need?

Edit: Note that I can't move the files above the web root directory, because some files must have direct access while others must not. So I have to keep them all in the same directory and be able to enable/disable direct downloading selectively.

share|improve this question
up vote 1 down vote accepted

Nginx has a directive for that. You may mark a location as "internal" which means Nginx processes it only as a result of rewrite, X-Accel-Redirect and alike. If you'd try to request this location directly, you'll get 404 "Not Found" response.

location /downloads {

location /scripts {
  # should issue X-Accel-Redirect: /downloads/file.ext
share|improve this answer
Yeah, I eventually figured that out. The problem is, as some files should be directly downloadable and some should not, I can't really do that. So, I think I'll adjust my needs and make two different folders. Thanks anyway. I'll accept the answer because it will help others who don't know about the internal directive. – pt2ph8 May 19 '11 at 13:11

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.